IAM Policy to Deny Actions Without MFA

MFA Enforcement Policy

Requiring multi-factor authentication (MFA) for sensitive operations adds a strong layer of security. This policy denies all actions unless the request was authenticated with MFA.

Policy JSON

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyAllWithoutMFA",
      "Effect": "Deny",
      "NotAction": [
        "iam:CreateVirtualMFADevice",
        "iam:EnableMFADevice",
        "iam:GetUser",
        "iam:ListMFADevices",
        "iam:ListVirtualMFADevices",
        "iam:ResyncMFADevice",
        "sts:GetSessionToken"
      ],
      "Resource": "*",
      "Condition": {
        "BoolIfExists": {
          "aws:MultiFactorAuthPresent": "false"
        }
      }
    }
  ]
}

NotAction (Not "Action")

This policy uses NotAction instead of Action. This means "deny everything EXCEPT the listed actions when MFA is not present." The excepted actions allow the user to set up and manage their MFA device — without this exception, a user without MFA could never enable it.

BoolIfExists

BoolIfExists is used instead of Bool because:

• aws:MultiFactorAuthPresent is not present at all in requests using long-term access keys (not just "false").
• BoolIfExists evaluates to true when the key exists and is "false", AND when the key does not exist at all.
• Bool alone would not catch long-term access key requests.

How to Use This Policy

Attach this policy alongside the user's permission policies. The Deny always wins over any Allow, so even if other policies grant broad access, those permissions only work after MFA authentication.

Workflow for Users

1. Authenticate with username/password
2. Call sts:GetSessionToken with MFA code
3. Use the returned temporary credentials for all subsequent API calls